NEW YORK STATE SECURITY' BREACH REPORTING FORM 

Pursuant to the Information Security Breach and Notification Act 
(General Business Law §899-aa) 


Name and address of Entity that owns or licenses the computerized data that was subject to the breach: 

McCabe. Martin. Coleman & Ventosa, PLLC 

Street Address: 42 Catharine Street 

City: Poughkeepsie State: New York Zip Code: 12601 


Submitted by: Christopher W. Meyer Title: Of Counsel Dated: August 17, 2018 
Firm Name (if other than entity): Whiteman, Osterman & Hanna LLP 
Telephone: (5181 487-7712 Email: cmever@woh.com 

Relationship to Entity whose information was compromised: Attorney _ 


Type of Organization (please select one): [ ] Governmental Entity in New York State; [ ] Other Governmental Entity; [ ] 
Educational; [ ]Health Care; [ )Financial Services; [XJOther Commercial; or | ]Not-for-profit. 


Number of Persons Affected: 

Total (Including NYS residents): Fewer than 535 NYS Residents: Fewer than 507 

If the number of NYS residents exceeds 5,000, have the consumer reporting agencies been notified? I 1 Yes IXI No 


Dates: Breach Occurred: April 1, 2018 Breach Discovered: lune 20, 2018 Consumer Notification: August 17, 2018 


Description of Breach (please select all that apply): 

| )Loss or theft of device or media (e.g., computer, laptop, external hard drive, thumb drive, CD, tape); 

[ (Internal system breach; [ (Insider wrongdoing; [XJExternal system breach (e.g., hacking); 

[ (Inadvertent disclosure ; [ (Other specify): _ 


Information Acquired: Name or other personal identifier in combination with (please select ail that apply): 
[X|Social Security Number 

[X|Driver's license number or non-driver identification card number 

[X|Financial account number or credit or debit card number, in combination with the security code, access code, 
password, or PIN for the account 


Manner of Notification to Affected Persons - ATTACH A COPY OF THE TEMPLATE OF THE 
NOTICE TO AFFECTED NYS RESIDENTS: 

[X] Written ( ( Electronic [ J Telephone [ ) Substitute notice 

List dates of any previous (within 12 months) breach notifications: None 


Identify Theft Protection Service Offered: [ (Yes |X] No 

Duration:__Provider: _ 

Brief Description of Service: _ 













































MCCABE MARTIN 

COLEMAN & VENTOSA PLLC 


ATTORNEYS AT LAW 


DANIEL J. MCCABE, Esq. 
JEFFREY C. MARTIN, Esq. 
CHRISTOPHER S. COLEMAN, Esq. 
JOHN J. VENTOSA, Esq. 


Of Counsel 

DAVID L. STEINBERG, Esq. 
JOHN B. CLARKE, Esq. 


August 17, 2018 
Dear Sir/Madam: 

We are writing to let you know that our firm’s email was recently attacked by an 
unknown computer hacker, who used information apparently obtained during the attack in an 
unsuccessful attempt to steal money from the firm. 

The firm has investigated this incident and it appears that the hacker accessed certain 
emails sent or received between April 1, 2018 and June 15, 2018. The finn is taking this matter 
very seriously and has implemented additional security measures to reduce the threat of a similar 
attack in the future. 

The firm has no reason to believe the attack is ongoing and has no evidence that the 
hacker has attempted to misuse any information other than the firm’s financial account 
information. Nevertheless, we are sharing this information with you, because the hacker appears 
to have obtained access to emails containing personal and confidential information. 

Please contact us if you have questions about specific information, if any, the hacker may 
have obtained about you. In general, the types of information that the hacker may have obtained 
include (1) your name, social security number, driver’s license number or non-driver ID number, 
credit card or bank account number, and (2) other information sent via email about you, 
including confidential legal matters we may have been handling on your behalf. 

If you are concerned about the particular content of emails which may have been 
improperly accessed during such time frame, please contact us and we will undertake a further 
analysis with you. 

We will notify you if the firm learns any new information about the breach that may 
affect you. In the meantime, out of an abundance of caution, please review the attachment to this 
letter for information regarding immediate steps you can take to protect yourself and your 
personal information. 

The firm deeply regrets any concern or inconvenience that this incident may cause you. 

Please do not hesitate to contact either Daniel McCabe or Christopher Coleman if you have 
questions or concerns. 

Sincerely, 

McCABE MARTIN COLEMAN & VENTOSA, PLLC 

PHONE 845.379.2222 WWW.MCCABEMARTIN.COM FAX 845.454.5934 

(electronic service not authorized ) 

' REPLY TO ADDRESS INDICATED 

42 Catharine St., Poughkeepsie, NY 12601 □ 187 East Market St., Ste. 204, P.O. Box 649, Rhinebeck, NY 12572 





Steps You Can Take to Protect Your Information 


As a precautionary measure, we recommend that you remain vigilant by reviewing your 
account statements and credit reports. You may also want to consider putting a security freeze 
on your credit file with each of the three credit reporting agencies. 

If you detect suspicious activity, you should promptly notify the financial institution or 
company that maintains the account. You also should promptly report any fraudulent activity or 
suspected identity theft to proper law enforcement authorities, the New York State Attorney 
General, and/or the Federal Trade Commission. 

You may obtain a free copy of your credit report from each of the three major credit 
reporting agencies once every 12 months by visiting: https://www.annualcreditreport.com , 
calling toll-free 1-877-322-8228, or by mailing an annual credit report request form to Annual 
Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348. You can find a copy of the 
request form at: https://www.annualcreditrenort.com/landingpage.action . 

You may also wish to consider placing a fraud alert on your credit report. An initial fraud 
alert is free and will stay on your credit file for at least 90 days. The alert informs creditors of 
possible fraudulent activity within your report and requests that the creditor contact you prior to 
establishing any accounts in your name. To place a fraud alert on your credit report, contact any 
of the three major reporting agencies: TransUnion: 1-800-680-7289, Experian: 1-888-397-3742, 
and Equifax: 1-888-766-0008. Ask the company to put a fraud alert on your credit line, and 
confirm that the company you called will contact the other two. Additional information is 
available at: https://www.annualcreditreport.com/protectYourIdentitv.action . 

You also have a right to place a “security freeze” on your credit file, which will prohibit a 
consumer credit reporting agency from accessing or releasing information in your credit report 
without your express consent. It will also prevent new credit from being opened in your name 
without the use of a PIN number that is issued to you. However, using a security freeze may 
delay or interfere with your ability to obtain credit. There also may be a fee of approximately $5 
to place, lift, or remove the security freeze. Additional information is available at: 
https://www.dos.nv.gov/consuinerprotection/pdf/Securitv%20Freeze031116.pdf . 

For additional information on how to avoid identity theft, the Federal Trade Commission 
provides a comprehensive guide to help you guard against, identify, and respond to identity theft, 
a copy of which may be found at: https :/Avww. consumer. ftc. gov/ arti cles/pdf- 
0009 identitytheft a recovery plan.pdf . For more information, please visit 
https://www.identitytheft.gov or call 1-877-ID-THEFT (1-877-438-4338). As a New York 
resident, you may also wish to review information provided by the New York Attorney General 
at https://ag.ny. gov/consumer-frauds-bureau/identitv-theft . 



